How severe is CVE-2024-22365?

CVE-2024-22365 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-22365 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-22365?

CVE-2024-22365 affects Linux-pam. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-22365?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-22365 have an EU (EUVD) identifier?

Yes. CVE-2024-22365 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19924.

When was CVE-2024-22365 published?

CVE-2024-22365 was published on 2024-02-06 and last updated on 2026-06-17.

CVE-2024-22365

CVE-2024-22365 is a medium-severity vulnerability in Linux-pam with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-664.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19924
Weakness: CWE-664
Affected product: Linux-pam
Published: 2024-02-06
Last modified: 2026-06-17

Description

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

Frequently asked questions

What is CVE-2024-22365?: linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
How severe is CVE-2024-22365?: CVE-2024-22365 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-22365 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-22365?: CVE-2024-22365 affects Linux-pam. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-22365?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-22365 have an EU (EUVD) identifier?: Yes. CVE-2024-22365 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19924.
When was CVE-2024-22365 published?: CVE-2024-22365 was published on 2024-02-06 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*

More vulnerabilities in Linux-pam

CVE-2022-28321 — Critical (CVSS 9.8): The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The…
CVE-2020-27780 — Critical (CVSS 9.8): A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users.…
CVE-2010-4708 — High (CVSS 7.2): The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory,…
CVE-2010-3853 — Medium (CVSS 6.9): pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking…
CVE-2009-0887 — Medium (CVSS 6.6): Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier,…
CVE-2015-3238 — Medium (CVSS 6.5): The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to…

All CVEs affecting Linux-pam →

Other CWE-664 vulnerabilities

CVE-2022-27518 — Critical (CVSS 9.8): Unauthenticated remote arbitrary code execution
CVE-2026-43503 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through…
CVE-2026-8517 — High (CVSS 8.8): Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who…
CVE-2019-5816 — High (CVSS 8.8): Process lifetime issue in Chrome in Google Chrome on Android prior to 74.0.3729.108 allowed a remote attacker to…
CVE-2022-20856 — High (CVSS 8.6): A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in…
CVE-2016-8763 — High (CVSS 7.8): The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software…

Browse all CWE-664 vulnerabilities →